@highflame/policy 2.2.35 → 2.2.36

package/_schemas/agent_ops/context.json

@@ -1229,6 +1229,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "path",
           "type": "string",

package/_schemas/agent_ops/schema.cedarschema

@@ -421,6 +421,13 @@ namespace AgentOps {
         // Tool Operation Classifier (optional)
         "tool_operation_classes"?: Set<String>,
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Boolean,

package/_schemas/ai_gateway/context.json

@@ -187,6 +187,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\". NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
         {
           "key": "mcp_server_verified",
           "type": "boolean",

package/_schemas/ai_gateway/schema.cedarschema

@@ -122,6 +122,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 

package/_schemas/guardrails/context.json

@@ -1066,6 +1066,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "cross_origin_detected",
           "type": "boolean",

package/_schemas/guardrails/schema.cedarschema

@@ -405,6 +405,13 @@ namespace Guardrails {
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Bool,

package/_schemas/overwatch/context.json

@@ -680,6 +680,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "package_install_detected",
           "type": "boolean",

package/_schemas/overwatch/schema.cedarschema

@@ -246,6 +246,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code
+
     // --- Session Detection History (cross-turn sticky flags) ---
     session_pii_detected?: Bool,
     session_pii_types?: Set<String>,

package/dist/agent_ops-context.gen.d.ts

@@ -41,6 +41,7 @@ export declare const AgentOpsContextKey: {
     readonly EncodedTypes: "encoded_types";
     readonly Event: "event";
     readonly ExecAllowlist: "exec_allowlist";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly FactualityScore: "factuality_score";
     readonly FlowCompartments: "flow_compartments";
     readonly FlowConfidentiality: "flow_confidentiality";
@@ -108,7 +109,9 @@ export declare const AgentOpsContextKey: {
     readonly PrincipalCompartments: "principal_compartments";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
     readonly RequestId: "request_id";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -158,15 +161,17 @@ export declare const AgentOpsContextKey: {
     readonly TopicConfidence: "topic_confidence";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly UserEmail: "user_email";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
     readonly WorkspaceRoot: "workspace_root";
     readonly WritablePaths: "writable_paths";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentOpsContextKey];
 /**
  * The full set of authorable context attribute keys for AgentOps.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "exec_target_paths", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths", "write_target_paths"];

package/dist/agent_ops-context.gen.js

@@ -43,6 +43,7 @@ export const AgentOpsContextKey = {
     EncodedTypes: 'encoded_types',
     Event: 'event',
     ExecAllowlist: 'exec_allowlist',
+    ExecTargetPaths: 'exec_target_paths',
     FactualityScore: 'factuality_score',
     FlowCompartments: 'flow_compartments',
     FlowConfidentiality: 'flow_confidentiality',
@@ -110,7 +111,9 @@ export const AgentOpsContextKey = {
     PrincipalCompartments: 'principal_compartments',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
     RequestId: 'request_id',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -160,11 +163,13 @@ export const AgentOpsContextKey = {
     TopicConfidence: 'topic_confidence',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     UserEmail: 'user_email',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
     WorkspaceRoot: 'workspace_root',
     WritablePaths: 'writable_paths',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for AgentOps.
@@ -207,6 +212,7 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.EncodedTypes,
     AgentOpsContextKey.Event,
     AgentOpsContextKey.ExecAllowlist,
+    AgentOpsContextKey.ExecTargetPaths,
     AgentOpsContextKey.FactualityScore,
     AgentOpsContextKey.FlowCompartments,
     AgentOpsContextKey.FlowConfidentiality,
@@ -274,7 +280,9 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.PrincipalCompartments,
     AgentOpsContextKey.PrivilegeScope,
     AgentOpsContextKey.ProfanityScore,
+    AgentOpsContextKey.ReadTargetPaths,
     AgentOpsContextKey.RequestId,
+    AgentOpsContextKey.ResolvedTargetPaths,
     AgentOpsContextKey.Role,
     AgentOpsContextKey.RpmExceeded,
     AgentOpsContextKey.RpmRemainingPct,
@@ -324,9 +332,11 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.TopicConfidence,
     AgentOpsContextKey.TpmExceeded,
     AgentOpsContextKey.TpmRemainingPct,
+    AgentOpsContextKey.UnresolvedTarget,
     AgentOpsContextKey.UserEmail,
     AgentOpsContextKey.ViolenceScore,
     AgentOpsContextKey.WeaponsScore,
     AgentOpsContextKey.WorkspaceRoot,
     AgentOpsContextKey.WritablePaths,
+    AgentOpsContextKey.WriteTargetPaths,
 ];

package/dist/ai_gateway-context.gen.d.ts

@@ -8,6 +8,7 @@ export declare const AiGatewayContextKey: {
     readonly Content: "content";
     readonly CrimeScore: "crime_score";
     readonly DetectedThreats: "detected_threats";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
     readonly IndirectInjectionScore: "indirect_injection_score";
@@ -42,6 +43,8 @@ export declare const AiGatewayContextKey: {
     readonly PiiTypes: "pii_types";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -78,12 +81,14 @@ export declare const AiGatewayContextKey: {
     readonly ToolRiskScore: "tool_risk_score";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type AiGatewayContextKey = (typeof AiGatewayContextKey)[keyof typeof AiGatewayContextKey];
 /**
  * The full set of authorable context attribute keys for AiGateway.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "exec_target_paths", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "read_target_paths", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "violence_score", "weapons_score", "write_target_paths"];

package/dist/ai_gateway-context.gen.js

@@ -10,6 +10,7 @@ export const AiGatewayContextKey = {
     Content: 'content',
     CrimeScore: 'crime_score',
     DetectedThreats: 'detected_threats',
+    ExecTargetPaths: 'exec_target_paths',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
     IndirectInjectionScore: 'indirect_injection_score',
@@ -44,6 +45,8 @@ export const AiGatewayContextKey = {
     PiiTypes: 'pii_types',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -80,8 +83,10 @@ export const AiGatewayContextKey = {
     ToolRiskScore: 'tool_risk_score',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for AiGateway.
@@ -91,6 +96,7 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.Content,
     AiGatewayContextKey.CrimeScore,
     AiGatewayContextKey.DetectedThreats,
+    AiGatewayContextKey.ExecTargetPaths,
     AiGatewayContextKey.HateSpeechScore,
     AiGatewayContextKey.HighestSeverity,
     AiGatewayContextKey.IndirectInjectionScore,
@@ -125,6 +131,8 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.PiiTypes,
     AiGatewayContextKey.PrivilegeScope,
     AiGatewayContextKey.ProfanityScore,
+    AiGatewayContextKey.ReadTargetPaths,
+    AiGatewayContextKey.ResolvedTargetPaths,
     AiGatewayContextKey.Role,
     AiGatewayContextKey.RpmExceeded,
     AiGatewayContextKey.RpmRemainingPct,
@@ -161,6 +169,8 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.ToolRiskScore,
     AiGatewayContextKey.TpmExceeded,
     AiGatewayContextKey.TpmRemainingPct,
+    AiGatewayContextKey.UnresolvedTarget,
     AiGatewayContextKey.ViolenceScore,
     AiGatewayContextKey.WeaponsScore,
+    AiGatewayContextKey.WriteTargetPaths,
 ];

package/dist/ai_gateway-detectors.gen.js

@@ -107,7 +107,7 @@ export const AI_GATEWAY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 1,
-        emits: [{ name: "tool_name", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_category", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_is_builtin", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_is_sensitive", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set" }, { name: "tool_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Tool-call risk score (0-100)." }],
+        emits: [{ name: "tool_name", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_category", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_is_builtin", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_is_sensitive", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set" }, { name: "resolved_target_paths", type: "String", modifiable: false, description: "Newline-delimited (leading+trailing \\n) union of statically-resolved absolute target paths, any capability. Cedar `like` is anchored so patterns start with `*`: sub-tree `*\\n/etc/*`, bare dir `*\\n/etc\\n*`, exact `*\\n/etc/passwd\\n*`." }, { name: "read_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command reads or enumerates. \\n-anchored — match with `like` patterns starting with `*`." }, { name: "write_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command writes, creates, or destroys. \\n-anchored — match with `like` patterns starting with `*`." }, { name: "exec_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths executed as a script. \\n-anchored — match with `like` patterns starting with `*`." }, { name: "unresolved_target", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." }, { name: "tool_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Tool-call risk score (0-100)." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["excessive_agency", "unauthorized_access", "tool_hijacking"],
         exampleAttacks: [],
@@ -187,6 +187,7 @@ export const AI_GATEWAY_DETECTORS = [
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
 export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "crime_score": ["toxicity"],
+    "exec_target_paths": ["tool_risk"],
     "hate_speech_score": ["toxicity"],
     "indirect_injection_score": ["deepcontext"],
     "injection_score": ["injection"],
@@ -216,6 +217,8 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "pii_score": ["pii"],
     "pii_types": ["pii"],
     "profanity_score": ["toxicity"],
+    "read_target_paths": ["tool_risk"],
+    "resolved_target_paths": ["tool_risk"],
     "rug_pull_detected": ["rug_pull"],
     "rug_pull_score": ["rug_pull"],
     "secret_count": ["secrets"],
@@ -241,8 +244,10 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "tool_poisoning_detected": ["tool_poisoning"],
     "tool_poisoning_score": ["tool_poisoning"],
     "tool_risk_score": ["tool_risk"],
+    "unresolved_target": ["tool_risk"],
     "violence_score": ["toxicity"],
     "weapons_score": ["toxicity"],
+    "write_target_paths": ["tool_risk"],
 };
 export function aiGatewayDetectorById(id) {
     return AI_GATEWAY_DETECTORS.find((d) => d.id === id);

package/dist/guardrails-context.gen.d.ts

@@ -36,6 +36,7 @@ export declare const GuardrailsContextKey: {
     readonly EncodedCount: "encoded_count";
     readonly EncodedScore: "encoded_score";
     readonly EncodedTypes: "encoded_types";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly FactualityScore: "factuality_score";
     readonly HallucinationScore: "hallucination_score";
     readonly HateSpeechScore: "hate_speech_score";
@@ -97,7 +98,9 @@ export declare const GuardrailsContextKey: {
     readonly Principal: "principal";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
     readonly RequestId: "request_id";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -143,12 +146,14 @@ export declare const GuardrailsContextKey: {
     readonly TopicConfidence: "topic_confidence";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type GuardrailsContextKey = (typeof GuardrailsContextKey)[keyof typeof GuardrailsContextKey];
 /**
  * The full set of authorable context attribute keys for Guardrails.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_input_request_detected", "mcp_input_request_methods", "mcp_input_request_score", "mcp_input_request_types", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "exec_target_paths", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_input_request_detected", "mcp_input_request_methods", "mcp_input_request_score", "mcp_input_request_types", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "violence_score", "weapons_score", "write_target_paths"];

package/dist/guardrails-context.gen.js

@@ -38,6 +38,7 @@ export const GuardrailsContextKey = {
     EncodedCount: 'encoded_count',
     EncodedScore: 'encoded_score',
     EncodedTypes: 'encoded_types',
+    ExecTargetPaths: 'exec_target_paths',
     FactualityScore: 'factuality_score',
     HallucinationScore: 'hallucination_score',
     HateSpeechScore: 'hate_speech_score',
@@ -99,7 +100,9 @@ export const GuardrailsContextKey = {
     Principal: 'principal',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
     RequestId: 'request_id',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -145,8 +148,10 @@ export const GuardrailsContextKey = {
     TopicConfidence: 'topic_confidence',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for Guardrails.
@@ -184,6 +189,7 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.EncodedCount,
     GuardrailsContextKey.EncodedScore,
     GuardrailsContextKey.EncodedTypes,
+    GuardrailsContextKey.ExecTargetPaths,
     GuardrailsContextKey.FactualityScore,
     GuardrailsContextKey.HallucinationScore,
     GuardrailsContextKey.HateSpeechScore,
@@ -245,7 +251,9 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.Principal,
     GuardrailsContextKey.PrivilegeScope,
     GuardrailsContextKey.ProfanityScore,
+    GuardrailsContextKey.ReadTargetPaths,
     GuardrailsContextKey.RequestId,
+    GuardrailsContextKey.ResolvedTargetPaths,
     GuardrailsContextKey.Role,
     GuardrailsContextKey.RpmExceeded,
     GuardrailsContextKey.RpmRemainingPct,
@@ -291,6 +299,8 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.TopicConfidence,
     GuardrailsContextKey.TpmExceeded,
     GuardrailsContextKey.TpmRemainingPct,
+    GuardrailsContextKey.UnresolvedTarget,
     GuardrailsContextKey.ViolenceScore,
     GuardrailsContextKey.WeaponsScore,
+    GuardrailsContextKey.WriteTargetPaths,
 ];